CVE-2026-71192 OpenStack CVE debrief

Who should care

Defenders responsible for OpenStack Swift deployments, particularly those using the s3_acl=true configuration, should assess their exposure and verify their configurations to prevent unauthorized access to sensitive data.

Why it matters

CVE-2026-71192 is a vulnerability in OpenStack Swift that allows an attacker to bypass source object authorization and potentially access private objects in other tenants' accounts. Defenders should prioritize verifying their configurations and monitoring for suspicious activity to prevent unauthorized access to sensitive data.

• Potential unauthorized access to private objects in other tenants' accounts.
• Possible data breaches or exposure of sensitive information.
• Need for verification of OpenStack Swift configurations and monitoring for suspicious activity.
• Potential impact on cloud storage security and compliance.

Technical summary

The S3API middleware in OpenStack Swift does not sanitize Swift-native control headers from S3 API requests when s3_acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a server-side copy from another tenant's private object. The source object authorization is bypassed because the S3API middleware has already authorized the request against the destination.

Defensive priority

Defenders should prioritize verifying their OpenStack Swift configurations and monitoring for suspicious activity.

Recommended defensive actions

• Verify OpenStack Swift configurations to ensure s3_acl=true is not enabled unnecessarily.
• Monitor for suspicious activity, such as unusual PUT requests or access to private objects.
• Review and update access controls to prevent unauthorized access to sensitive data.
• Perform a thorough review of existing Swift configurations and update them according to best practices.
• Implement additional monitoring to detect potential exploitation attempts.
• Conduct an asset inventory to identify potentially affected systems.
• Track changes to Swift configurations and monitor for any reintroduction of the vulnerability.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected product. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.